Latest Adobe Vulnerabilities

● CVE-2024-34130
Acrobat Android : OverSecured Finding : Access to arbitrary* content providers via insecure Intent configuration
Adobe Acrobat Reader Android<24.5.0.33694
● CVE-2024-34129
Acrobat Android : OverSecured Finding : Overwriting arbitrary files via attacker-controlled output file paths
Adobe Acrobat Reader Android<24.5.0.33694
● CVE-2024-34113
Coldfusion - Default encrypt method (CFMX_COMPAT) allows decrypting with only 4 known chars
Adobe ColdFusion=2021-update1
Adobe ColdFusion=2021-update10
Adobe ColdFusion=2021-update11
Adobe ColdFusion=2021-update12
Adobe ColdFusion=2021-update13
Adobe ColdFusion=2021-update2
and 14 more
● CVE-2024-34116
Adobe Creative Cloud App Install Arbitrary Folder Delete Vulnerability can be abuse to Privilege Escalation
Adobe Creative Cloud Desktop Application<6.2.0.554
● CVE-2024-34115
ZDI-CAN-24054: Adobe Substance 3D Stager SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe Substance 3D Stager<=3.0.2
● CVE-2024-30300
Tenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS Worker
Adobe FrameMaker Publishing Server<2020
Adobe FrameMaker Publishing Server=2020
Adobe FrameMaker Publishing Server=2020-update1
Adobe FrameMaker Publishing Server=2020-update2
Adobe FrameMaker Publishing Server=2020-update3
Adobe FrameMaker Publishing Server=2022
and 2 more
● CVE-2024-30299
Tenable Vulnerability Disclosure | API Auth Bypass
Adobe FrameMaker Publishing Server<2020
Adobe FrameMaker Publishing Server=2020
Adobe FrameMaker Publishing Server=2020-update1
Adobe FrameMaker Publishing Server=2020-update2
Adobe FrameMaker Publishing Server=2020-update3
Adobe FrameMaker Publishing Server=2022
and 2 more
● CVE-2024-20753
Adobe Photoshop PDF File Parsing Memory Corruption Remote Code Execution Vulnerability
Adobe Photoshop<24.7.4
Adobe Photoshop>=25.0<25.9
Apple macOS
Microsoft Windows
● CVE-2024-30278
Adobe Media Encoder 2024 TGA File parsing memory corruption
Adobe Media Encoder<=23.6.5
Adobe Media Encoder>=24.0<=24.3
● CVE-2024-34106
Insecure Direct Object Reference - An attacker can able to erase the victim quote details
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-34103
Customer account takeover via web API call & subsequent password reset
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-34109
RCE in Adobe Commerce Webhook module via POST /admin/webhooks/hook/save/key/{key} `general[webhook_method]` form data
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-34110
RCE in the Adobe Commerce Webhook module through a legit webhook definition
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-34111
SSRF in service connector
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-34107
A guest customer can associate other customer's shipping address to its guest cart which allows guest being able to view other customer's address
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-34105
Stored Cross Site Scripting in Order Comment
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-34104
Existing orders can be overwritten by anothers user cart via PUT to `/rest/default/V1/carts/mine`
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-34102
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
composer/magento/community-edition=2.4.7
composer/magento/community-edition=2.4.6
composer/magento/community-edition=2.4.5
composer/magento/community-edition<2.4.4-p9
composer/magento/community-edition>=2.4.5-p1<2.4.5-p8
composer/magento/community-edition>=2.4.6-p1<2.4.6-p6
and 73 more
● CVE-2024-34108
Large attack surface through legit webhook usage in Adobe Commerce
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.3.7-p4
Adobe Commerce=2.3.7-p4-ext1
and 65 more
● CVE-2024-30285
Adobe Audition 2024 MP4 File Parsing Null Pointer Dereference
Adobe Audition<=23.6.4
Adobe Audition=24.0
Adobe Audition=24.1
● CVE-2024-30276
Adobe Audition 2024 M2V File Parsing Memory corruption
Adobe Audition<=23.6.4
Adobe Audition=24.0
Adobe Audition=24.1
● CVE-2024-36213
AMS XSS - /libs/dam/gui/components/admin/assetpicker/demo/clientlibs/demo/js/demo.js
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26126
HTML Injection at `https://author-bugbounty-65-prod.adobecqms.net/libs/cq/tagging/gui/content/tags/mergetag.html/*`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36150
AMS JS - /libs/mcm/campaign/components/touch-ui/clientlibs/core/js/PlaintextGenerator.js
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36239
DOM XSS in `libs/cq/experience-fragments/components/admin/previewvariation/clientlib/publish.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36238
DOM XSS in `libs/granite/ui/components/shell/clientlibs/shell/js/onboarding.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26037
DOM XSS in `libs/cq/gui/components/projects/admin/translation/job/accepttranslation/clientlibs/js/accepttranslation.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36156
AMS XSS - /libs/cq/gui/components/coral/common/admin/timeline/clientlibs/timeline/js/events.js
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-20769
AMS XSS - /libs/cq/gui/components/projects/admin/translation/customsearch/assettype/clientlibs/assettype/js/assettype.js
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36229
DOM XSS in `/libs/granite/ui/components/coral/foundation/clientlibs/foundation/js/collection/action/action/foundation.pushstate.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36236
DOM XSS in `libs/granite/oauth/clientlibs/clientlist/js/clientlist.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36157
AMS XSS - /libs/granite/ui/components/shell/clientlibs/shell/js/badge.js
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-34120
AMS XSS - /libs/cq/searchpromote/components/linklist/facetcontent.jsp (retest of 1914167 - not fixed)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26082
Stored XSS in `libs/cq/gui/components/common/admin/managepublication/clientlibs/managepublication/js/managepublication.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26088
AMS XSS - /libs/dam/cfm/admin/clientlibs/adminpage/actions/js/managepublication.js (JS)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36211
AMS XSS - /libs/foundation/components/parbase/scaffolding.jsp (bypass for report 2134793)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36224
DOM XSS in `/libs/dam/gui/coral/components/admin/customsearch/savedsearch/actiondialogs/clientlibs/actiondialogs/dialogs.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36233
DOM XSS in `libs/granite/ui/components/coral/foundation/clientlibs/foundation/js/coral/coral2.js` (coral-Autocomplete)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36225
AMS XSS - /libs/dam/gui/components/admin/commons/redirecttopreviouspage/clientlibs/redirecttopreviouspage/js/redirecttopreviouspage.js (js)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26110
Cloud Services - /libs/cq/contexthub/components/new-segment/clientlib/wizard.new-segment.js (JS)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36153
AMS XSS - /libs/cq/personalization/touch-ui/clientlibs/audiences/newFolder.js
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36206
AMS XSS - /libs/clientlibs/social/hbs/moderationfoundation/moderationfoundation.js
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36160
AMS XSS - /libs/fd/af/authoring/clientlibs/guideCommonAuthoring/js/GuidePanelEdit.js
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26075
Stored XSS in `libs/dam/cfm/admin/clientlibs/v2/authoring/contenteditor/unique.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36230
DOM XSS in `/libs/dam/gui/coral/components/admin/welcome/clientlibs/welcome/js/welcome.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36144
AMS XSS - /libs/cq/searchpromote/components/sorting/sorting.jsp (retest of 2001313 - not fixed)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26074
Stored XSS in `libs/dam/cfm/models/editor/components/fragmentreference/clientlibs/modeleditor/js/defaultValue.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26111
AMS XSS - /libs/fd/af/components/guideradiobutton (retest of 2088443 - new issue)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-36222
DOM XSS in `/libs/dam/gui/coral/components/admin/customthumb/clientlibs/customthumb.js`
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5
● CVE-2024-26060
AMS XSS - /libs/cq/inbox/gui/components/inbox/table/table.jsp (include)
Adobe Experience Manager<6.5.21
Adobe Experience Manager<2024.5

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203